I am not completely clear between the difference and the purpose of default service accounts and service agents in google cloud. From the documentation:
Default Service Accounts:
Default service accounts are user-managed service accounts that are created automatically when you enable or use certain Google Cloud services. These service accounts let the service deploy jobs that access other Google Cloud resources. You are responsible for managing default service accounts after they are created.
Service Agents:
Some Google Cloud services need access to your resources so that they can act on your behalf. For example, when you use Cloud Run to run a container, the service needs access to any Pub/Sub topics that can trigger the container.
Bsed on the above, both of them are used by Google services. And, I understand the following differences/similarities between them:
- Both are created automatically
- Service agents are managed by Google whereas Default Service Accounts are managed by end user
- Service agents are not created in user projects and are not visible (at least with default settings) in the IAM page and cannot be accessed directly as opposed to Default Service Accounts
- If an application runs in a Google Cloud environment that has a default service account, the application can use the credentials for the default service account to call Google Cloud APIs
I also see that, according to the documentation, the Default Service Accounts are associated with specific services (App Engine, and any Google Cloud service that uses App Engine AND Compute Engine, and any Google Cloud service that uses Compute Engine).
Keeping in mind the above points, I am not sure I understand the need for user managed service accounts, default service accounts and service agents:
- User managed service account: for use by user applications
- Default service account: for use by Google services themselves and also by user applications
- Service agent: for use by Google services themselves (for example for GKE to launch VMs)
Why have default service accounts? Seems their scope can be covered by either user managed service accounts or service agents. Or is my understanding incorrect and default service accounts are only used by user applications that run for example, on a VM, in which case they are more of a convenience feature?
6
“Difference between google cloud default service account and service
agent?”
Comment mentioned by DazWilkin is correct.User or Default Service Accounts are owned by your Project. You can use these Service Accounts. But you should create your own, more specific IAM role accounts to use in production. Service Agents are owned by Google. Google uses the Service Accounts to affect behavior in your projects’ resources.
As per this official doc
User-managed service accounts are Service accounts that you create and manage. These service accounts are often used as identities
for workloads.Default service accounts are User-managed service accounts that are created automatically when you enable certain Google Cloud
services. You are responsible for managing these service accounts.Service agents are Service accounts that are created and managed by Google Cloud, and that allow services to access resources on your
behalf.
This official document describes how service accounts work with Compute Engine.
As per this When you set up an instance to run as a service account,
you determine the level of access the service account has by the IAM
roles that you grant to the service account. If the service
account has no IAM roles, then no resources can be accessed using the
service account on that instance.
See this official document about Choose when to use service accounts